Cancel a pairing code
Stops a code being claimable. Requires the **viewer** role.
curl -X DELETE "https://example.com/api/pair/codes/string"Mint a pairing code POST
Creates a single-use code, claimable for five minutes, and the offer URL the dashboard renders as a QR code. The secret travels in the URL fragment so it never reaches a server log. Requires a signed-in session: a paired device may not mint another code, which is what stops a stolen phone from cloning itself. Requires the **viewer** role. An optional client UUID lets the caller check or cancel the exact code after a lost response. Reusing an existing UUID never reissues its secret.
Server identity GET
Who this server is, for a device that has not paired yet. Deliberately unauthenticated: a phone has no credential at this point and needs the TLS certificate fingerprint before it can safely talk to anything. It is answered even when the license is locked or Udon does not yet have Admin Privileges. Rate limited. Discloses no usernames, license state, hardware serial, or address list.